Critical-severity CVEs (page 2)
Page 2 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-49819 | Critical | 9.8 | 2026-08-13 | UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperus… |
CVE-2026-16770 | Critical | 9.8 | 2026-08-13 | PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. For an HTML string or file source, t… |
CVE-2026-71193 | Critical | 9.6 | 2026-08-12 | In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool onl… |
CVE-2026-49481 | Critical | 9.6 | 2026-08-12 | UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the… |
CVE-2026-73519 | Critical | 9.8 | 2026-08-12 | WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing… |
CVE-2026-73501 | Critical | 9.1 | 2026-08-12 | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a… |
CVE-2026-71471 | Critical | 9.0 | 2026-08-12 | A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Res… |
CVE-2026-18749 | Critical | 9.8 | 2026-08-12 | The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has… |
CVE-2024-27253 | Critical | 10.0 | 2026-08-12 | IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities. |
CVE-2026-66898 | Critical | 9.9 | 2026-08-12 | A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restori… |
CVE-2026-19001 | Critical | 9.8 | 2026-08-12 | The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or obj… |
CVE-2026-73269 | Critical | 9.9 | 2026-08-12 | A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigge… |
CVE-2026-73268 | Critical | 9.9 | 2026-08-12 | A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resourc… |
CVE-2026-72508 | Critical | 9.9 | 2026-08-12 | A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin… |
CVE-2026-63300 | Critical | 9.9 | 2026-08-12 | An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_inst… |
CVE-2026-63299 | Critical | 9.9 | 2026-08-12 | An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify… |
CVE-2026-63298 | Critical | 9.9 | 2026-08-12 | An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitra… |
CVE-2026-63297 | Critical | 9.9 | 2026-08-12 | An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restri… |
CVE-2026-63296 | Critical | 9.9 | 2026-08-12 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating a… |
CVE-2026-63294 | Critical | 9.9 | 2026-08-12 | A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image… |
CVE-2026-63293 | Critical | 9.9 | 2026-08-12 | A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an… |
CVE-2026-62420 | Critical | 9.9 | 2026-08-12 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migr… |
CVE-2026-19656 | Critical | 9.9 | 2026-08-12 | ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-… |
CVE-2026-17083 | Critical | 9.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. |
CVE-2026-73300 | Critical | 9.6 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enablin… |
CVE-2026-73299 | Critical | 10.0 | 2026-08-12 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty te… |
CVE-2026-17276 | Critical | 9.6 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority… |
CVE-2026-17218 | Critical | 9.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. |
CVE-2026-16956 | Critical | 9.8 | 2026-08-12 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in a… |
CVE-2026-16860 | Critical | 9.9 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element. |
CVE-2026-73296 | Critical | 9.4 | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mo… |
CVE-2026-73240 | Critical | 9.8 | 2026-08-12 | Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to up… |
CVE-2026-73294 | Critical | 9.9 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --uploa… |
CVE-2026-73263 | Critical | 9.9 | 2026-08-12 | Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provide… |
CVE-2026-50561 | Critical | 9.4 | 2026-08-12 | Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mec… |
CVE-2025-59324 | Critical | 9.1 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity c… |
CVE-2025-59321 | Critical | 9.8 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to b… |
CVE-2025-59326 | Critical | 9.8 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be… |
CVE-2026-26035 | Critical | 9.8 | 2026-08-12 | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through… |
CVE-2025-41769 | Critical | 9.8 | 2026-08-12 | The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could… |
CVE-2026-66659 | Critical | 9.3 | 2026-08-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This… |
CVE-2026-18391 | Critical | 9.8 | 2026-08-12 | The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage… |
CVE-2026-18366 | Critical | 9.8 | 2026-08-12 | The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already mad… |
CVE-2026-16538 | Critical | 9.1 | 2026-08-12 | The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowi… |
CVE-2026-16051 | Critical | 9.8 | 2026-08-12 | The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect… |
CVE-2026-15039 | Critical | 9.8 | 2026-08-12 | The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload a… |
CVE-2026-72526 | Critical | 9.9 | 2026-08-12 | A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Applic… |
CVE-2026-70398 | Critical | 9.6 | 2026-08-12 | A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, refer… |
CVE-2026-68431 | Critical | 9.1 | 2026-08-12 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the mini… |
CVE-2026-68067 | Critical | 9.8 | 2026-08-11 | The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching… |
CVE-2026-67568 | Critical | 9.1 | 2026-08-11 | The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could resu… |
CVE-2026-5917 | Critical | 9.6 | 2026-08-11 | libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote… |
CVE-2026-71290 | Critical | 9.1 | 2026-08-11 | Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when us… |
CVE-2026-66147 | Critical | 9.4 | 2026-08-11 | An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker… |
CVE-2026-48765 | Critical | 9.9 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readabl… |
CVE-2026-73034 | Critical | 9.8 | 2026-08-11 | DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by i… |
CVE-2026-73032 | Critical | 9.6 | 2026-08-11 | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code fro… |
CVE-2026-66145 | Critical | 9.1 | 2026-08-11 | An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read… |
CVE-2026-45618 | Critical | 10.0 | 2026-08-11 | LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Versi… |
CVE-2026-16230 | Critical | 9.8 | 2026-08-11 | The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in a… |
CVE-2026-73211 | Critical | 9.8 | 2026-08-11 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub… |
CVE-2026-73090 | Critical | 9.3 | 2026-08-11 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update contai… |
CVE-2026-71398 | Critical | 10.0 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curren… |
CVE-2026-71362 | Critical | 9.1 | 2026-08-11 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability… |
CVE-2026-69102 | Critical | 9.8 | 2026-08-11 | MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attack… |
CVE-2026-48381 | Critical | 9.0 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2026-47705 | Critical | 9.6 | 2026-08-11 | TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or es… |
CVE-2026-27302 | Critical | 10.0 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curren… |
CVE-2026-71384 | Critical | 9.6 | 2026-08-11 | is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass… |
CVE-2026-70306 | Critical | 9.3 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform… |
CVE-2026-69223 | Critical | 9.1 | 2026-08-11 | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgr… |
CVE-2026-65791 | Critical | 9.8 | 2026-08-11 | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network. |
CVE-2026-62893 | Critical | 9.8 | 2026-08-11 | Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network. |
CVE-2026-62878 | Critical | 9.8 | 2026-08-11 | Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network. |
CVE-2026-62815 | Critical | 9.8 | 2026-08-11 | Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. |
CVE-2026-59124 | Critical | 9.8 | 2026-08-11 | Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network. |
CVE-2026-50516 | Critical | 9.4 | 2026-08-11 | Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-48362 | Critical | 10.0 | 2026-08-11 | ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbi… |
CVE-2026-12571 | Critical | 9.8 | 2026-08-11 | An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover. |
CVE-2026-73080 | Critical | 9.3 | 2026-08-11 | SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remot… |
CVE-2026-73069 | Critical | 9.1 | 2026-08-11 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permiss… |
CVE-2026-72920 | Critical | 9.8 | 2026-08-11 | SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication… |
CVE-2026-17061 | Critical | 10.0 | 2026-08-11 | A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated re… |
CVE-2026-51584 | Critical | 9.8 | 2026-08-11 | An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/a… |
CVE-2026-48056 | Critical | 10.0 | 2026-08-11 | Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplie… |
CVE-2026-46670 | Critical | 9.8 | 2026-08-11 | YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allo… |
CVE-2026-72748 | Critical | 9.1 | 2026-08-11 | AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4… |
CVE-2026-58115 | Critical | 10.0 | 2026-08-11 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). A… |
CVE-2026-18972 | Critical | 9.6 | 2026-08-11 | An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an acc… |
CVE-2026-72603 | Critical | 9.9 | 2026-08-11 | An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newl… |
CVE-2026-72599 | Critical | 9.8 | 2026-08-11 | An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The paramete… |
CVE-2026-72550 | Critical | 9.8 | 2026-08-11 | An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the… |
CVE-2026-58231 | Critical | 10.0 | 2026-08-11 | SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking… |
CVE-2026-10579 | Critical | 9.8 | 2026-08-11 | A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting a… |
CVE-2026-19516 | Critical | 9.1 | 2026-08-11 | A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller al… |
CVE-2026-13716 | Critical | 9.1 | 2026-08-11 | Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitte… |
CVE-2026-19425 | Critical | 9.8 | 2026-08-11 | Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL… |
CVE-2026-44758 | Critical | 9.1 | 2026-08-11 | SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionalit… |
CVE-2026-34265 | Critical | 9.8 | 2026-08-11 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. Th… |
CVE-2026-72911 | Critical | 9.9 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/… |